Exploited Host.

Unauthorized SSH login attempts

SSH-BruteForce

Mar 26 13:14:20 ns382633 sshd\[11070\]: Invalid user paul from 129.211.49.211 port 48820
Mar 26 13:14:20 ns382633 sshd\[11070\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.211
Mar 26 13:14:21 ns382633 sshd\[11070\]: Failed password for invalid user paul from 129.211.49.211 port 48820 ssh2
Mar 26 13:20:32 ns382633 sshd\[12581\]: Invalid user lena from 129.211.49.211 port 33662
Mar 26 13:20:32 ns382633 sshd\[12581\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.211

$f2bV_matches

Mar  7 05:54:13  sshd[17388]: Failed password for invalid user minecraft from 129.211.49.211 port 41734 ssh2

Feb 26 15:38:53 lukav-desktop sshd\[30527\]: Invalid user fredportela from 129.211.49.211
Feb 26 15:38:53 lukav-desktop sshd\[30527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.211
Feb 26 15:38:55 lukav-desktop sshd\[30527\]: Failed password for invalid user fredportela from 129.211.49.211 port 33676 ssh2
Feb 26 15:46:28 lukav-desktop sshd\[30728\]: Invalid user test from 129.211.49.211
Feb 26 15:46:28 lukav-desktop sshd\[30728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.211

$f2bV_matches

Invalid user user1 from 129.211.49.211 port 39964

Dec 24 10:17:37 vpn01 sshd[30417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.211
Dec 24 10:17:39 vpn01 sshd[30417]: Failed password for invalid user intihar from 129.211.49.211 port 60564 ssh2
...

SSH Brute Force, server-1 sshd[8188]: Failed password for root from 129.211.49.211 port 56734 ssh2

frenzy

2019-07-26T11:52:08.770531abusebot-5.cloudsearch.cf sshd\[17409\]: Invalid user uftp from 129.211.49.211 port 54168

Sep 14 08:45:34 raspberrypi sshd[22470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17 
Sep 14 08:45:36 raspberrypi sshd[22470]: Failed password for invalid user cpanelrrdtool from 129.211.49.17 port 38452 ssh2
...

frenzy

Aug 23 22:22:33 icinga sshd[1231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17 
Aug 23 22:22:35 icinga sshd[1231]: Failed password for invalid user postgres from 129.211.49.17 port 38904 ssh2
Aug 23 22:31:45 icinga sshd[16460]: Failed password for root from 129.211.49.17 port 38930 ssh2
...

(sshd) Failed SSH login from 129.211.49.17 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 10 14:00:47 grace sshd[8125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17  user=root
Aug 10 14:00:49 grace sshd[8125]: Failed password for root from 129.211.49.17 port 34702 ssh2
Aug 10 14:04:59 grace sshd[8243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17  user=root
Aug 10 14:05:01 grace sshd[8243]: Failed password for root from 129.211.49.17 port 52086 ssh2
Aug 10 14:08:51 grace sshd[8809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17  user=root

Aug  6 11:17:42 prox sshd[21979]: Failed password for root from 129.211.49.17 port 56582 ssh2

Aug  4 13:17:01 webhost01 sshd[28373]: Failed password for root from 129.211.49.17 port 38430 ssh2
...

2020-07-28T17:09:23.011457amanda2.illicoweb.com sshd\[4507\]: Invalid user daniel from 129.211.49.17 port 50330
2020-07-28T17:09:23.017631amanda2.illicoweb.com sshd\[4507\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17
2020-07-28T17:09:25.189244amanda2.illicoweb.com sshd\[4507\]: Failed password for invalid user daniel from 129.211.49.17 port 50330 ssh2
2020-07-28T17:15:39.631973amanda2.illicoweb.com sshd\[4913\]: Invalid user hanshow from 129.211.49.17 port 58180
2020-07-28T17:15:39.638743amanda2.illicoweb.com sshd\[4913\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17
...

$f2bV_matches

Unauthorized connection attempt detected from IP address 129.211.49.227 to port 10778

2020-07-16T11:52:07.704358vps773228.ovh.net sshd[6442]: Invalid user medved from 129.211.49.17 port 35032
2020-07-16T11:52:07.718553vps773228.ovh.net sshd[6442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17
2020-07-16T11:52:07.704358vps773228.ovh.net sshd[6442]: Invalid user medved from 129.211.49.17 port 35032
2020-07-16T11:52:09.658973vps773228.ovh.net sshd[6442]: Failed password for invalid user medved from 129.211.49.17 port 35032 ssh2
2020-07-16T11:57:46.359746vps773228.ovh.net sshd[6527]: Invalid user zz from 129.211.49.17 port 50372
...

[ssh] SSH attack

2020-07-10T06:05:00.618548hostname sshd[43277]: Invalid user ed from 129.211.49.17 port 40900
...

Jun 30 15:21:00 lukav-desktop sshd\[20705\]: Invalid user sga from 129.211.49.227
Jun 30 15:21:00 lukav-desktop sshd\[20705\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.227
Jun 30 15:21:02 lukav-desktop sshd\[20705\]: Failed password for invalid user sga from 129.211.49.227 port 60814 ssh2
Jun 30 15:25:07 lukav-desktop sshd\[20763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.227  user=root
Jun 30 15:25:09 lukav-desktop sshd\[20763\]: Failed password for root from 129.211.49.227 port 60122 ssh2

Jun 25 14:09:39 h2646465 sshd[16624]: Invalid user foswiki from 129.211.49.17
Jun 25 14:09:39 h2646465 sshd[16624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17
Jun 25 14:09:39 h2646465 sshd[16624]: Invalid user foswiki from 129.211.49.17
Jun 25 14:09:41 h2646465 sshd[16624]: Failed password for invalid user foswiki from 129.211.49.17 port 44616 ssh2
Jun 25 14:18:57 h2646465 sshd[17175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17  user=mysql
Jun 25 14:18:59 h2646465 sshd[17175]: Failed password for mysql from 129.211.49.17 port 58302 ssh2
Jun 25 14:23:18 h2646465 sshd[17460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.49.17  user=root
Jun 25 14:23:20 h2646465 sshd[17460]: Failed password for root from 129.211.49.17 port 56710 ssh2
Jun 25 14:27:28 h2646465 sshd[17715]: Invalid user fxy from 129.211.49.17
...

(sshd) Failed SSH login from 129.211.49.17 (CN/China/-): 5 in the last 3600 secs

2019-08-28 09:20:07 H=(lodenet.it) [91.203.224.177]:50045 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-08-28 09:20:07 H=(lodenet.it) [91.203.224.177]:50045 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/91.203.224.177)
2019-08-28 09:20:08 H=(lodenet.it) [91.203.224.177]:50045 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Aug 28 05:32:40 auw2 sshd\[22542\]: Invalid user informix from 106.51.33.29
Aug 28 05:32:40 auw2 sshd\[22542\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.33.29
Aug 28 05:32:42 auw2 sshd\[22542\]: Failed password for invalid user informix from 106.51.33.29 port 60416 ssh2
Aug 28 05:37:33 auw2 sshd\[22945\]: Invalid user hemant from 106.51.33.29
Aug 28 05:37:33 auw2 sshd\[22945\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.33.29

Aug 28 17:40:55 andromeda postfix/smtpd\[8351\]: warning: unknown\[80.82.77.18\]: SASL LOGIN authentication failed: authentication failure
Aug 28 17:41:04 andromeda postfix/smtpd\[8351\]: warning: unknown\[80.82.77.18\]: SASL LOGIN authentication failed: authentication failure
Aug 28 17:41:22 andromeda postfix/smtpd\[17648\]: warning: unknown\[80.82.77.18\]: SASL LOGIN authentication failed: authentication failure
Aug 28 17:41:32 andromeda postfix/smtpd\[16941\]: warning: unknown\[80.82.77.18\]: SASL LOGIN authentication failed: authentication failure
Aug 28 17:41:40 andromeda postfix/smtpd\[17655\]: warning: unknown\[80.82.77.18\]: SASL LOGIN authentication failed: authentication failure

Aug 28 04:31:17 php1 sshd\[4112\]: Invalid user demouser from 101.96.113.50
Aug 28 04:31:17 php1 sshd\[4112\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.113.50
Aug 28 04:31:19 php1 sshd\[4112\]: Failed password for invalid user demouser from 101.96.113.50 port 38332 ssh2
Aug 28 04:36:33 php1 sshd\[4590\]: Invalid user hermes from 101.96.113.50
Aug 28 04:36:33 php1 sshd\[4590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.113.50

Aug 28 10:20:22 localhost kernel: [739838.323482] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=124.6.187.118 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=28917 PROTO=TCP SPT=41963 DPT=139 WINDOW=1024 RES=0x00 SYN URGP=0 
Aug 28 10:20:22 localhost kernel: [739838.323509] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=124.6.187.118 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=28917 PROTO=TCP SPT=41963 DPT=139 SEQ=2798718976 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0

Aug 28 17:11:38 plex sshd[26265]: Invalid user visitante from 167.114.145.139 port 45334

Aug 28 11:26:48 plusreed sshd[9231]: Invalid user david from 142.93.198.152
...

firewall-block, port(s): 23/tcp

Aug 28 17:30:50 SilenceServices sshd[3272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.169.6
Aug 28 17:30:52 SilenceServices sshd[3272]: Failed password for invalid user cku from 192.99.169.6 port 52790 ssh2
Aug 28 17:35:37 SilenceServices sshd[5183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.169.6

*Port Scan* detected from 172.105.4.227 (CA/Canada/protoscan.ampereinnotech.com). 11 hits in the last 145 seconds

28.08.2019 15:06:43 SSH access blocked by firewall

Aug 28 15:01:37 hb sshd\[28836\]: Invalid user brands from 103.60.137.4
Aug 28 15:01:37 hb sshd\[28836\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.60.137.4
Aug 28 15:01:39 hb sshd\[28836\]: Failed password for invalid user brands from 103.60.137.4 port 49048 ssh2
Aug 28 15:10:18 hb sshd\[29569\]: Invalid user jsr from 103.60.137.4
Aug 28 15:10:18 hb sshd\[29569\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.60.137.4

2019-08-28T15:10:12.745855abusebot-8.cloudsearch.cf sshd\[6619\]: Invalid user oracle from 157.230.183.158 port 36530

Aug 28 10:20:20 Tower sshd[31079]: Connection from 113.17.111.19 port 3672 on 192.168.10.220 port 22
Aug 28 10:20:23 Tower sshd[31079]: Invalid user lxpopuser from 113.17.111.19 port 3672
Aug 28 10:20:23 Tower sshd[31079]: error: Could not get shadow information for NOUSER
Aug 28 10:20:23 Tower sshd[31079]: Failed password for invalid user lxpopuser from 113.17.111.19 port 3672 ssh2
Aug 28 10:20:23 Tower sshd[31079]: Received disconnect from 113.17.111.19 port 3672:11: Bye Bye [preauth]
Aug 28 10:20:23 Tower sshd[31079]: Disconnected from invalid user lxpopuser 113.17.111.19 port 3672 [preauth]

firewall-block, port(s): 8889/tcp